Changeset 15832

Timestamp:

10/18/2010 11:44:19 AM (16 years ago)

Author:

dd32

Message:

Use $wpdb->prepare in wp_old_slug_redirect(). See #15140

File:

• trunk/wp-includes/query.php (modified) (1 diff)

trunk/wp-includes/query.php

@@ -3147 +3147 @@
                 global $wpdb;
 
-                $query = "SELECT post_id FROM $wpdb->postmeta, $wpdb->posts WHERE ID = post_id AND meta_key = '_wp_old_slug' AND meta_value='" . $wp_query->query_vars['name'] . "'";
+                $query = $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta, $wpdb->posts WHERE ID = post_id AND meta_key = '_wp_old_slug' AND meta_value=%s", $wp_query->query_vars['name']);
 
                 // if year, monthnum, or day have been specified, make our query more precise
                 // just in case there are multiple identical _wp_old_slug values
                 if ( '' != $wp_query->query_vars['year'] )
-                        $query .= " AND YEAR(post_date) = '{$wp_query->query_vars['year']}'";
+                        $query .= $wpdb->prepare(" AND YEAR(post_date) = %d", $wp_query->query_vars['year']);
                 if ( '' != $wp_query->query_vars['monthnum'] )
-                        $query .= " AND MONTH(post_date) = '{$wp_query->query_vars['monthnum']}'";
+                        $query .= $wpdb->prepare(" AND MONTH(post_date) = %d", $wp_query->query_vars['monthnum']);
                 if ( '' != $wp_query->query_vars['day'] )
-                        $query .= " AND DAYOFMONTH(post_date) = '{$wp_query->query_vars['day']}'";
+                        $query .= $wpdb->prepare(" AND DAYOFMONTH(post_date) = %d", $wp_query->query_vars['day']);
 
                 $id = (int) $wpdb->get_var($query);
 
-                if ( !$id )
+                if ( ! $id )
                         return;